Data Processing Agreement

Effective: April 17, 2026

Plain-English disclaimer: this document was drafted by founders, not lawyers. It is designed for SMB deals under $50,000/year. For larger engagements or regulated industries (healthcare, finance, regulated professions), please request a reviewed contract or seek your own legal review before signing.

This Data Processing Agreement (“DPA”) supplements the Service Agreement between FluxSoft Technologies, LLC (“Processor”) and the customer (“Controller”). It governs the processing of personal data under the EU General Data Protection Regulation (GDPR) Art. 28, UK GDPR, and similar laws.

1. Subject matter and duration

Processor processes personal data on behalf of Controller only to provide FluxChat as described in the Service Agreement. Processing continues for the duration of the subscription and ceases within 30 days of termination, subject to backup rotation.

2. Nature and purpose of processing

Hosting and serving a chatbot trained on Controller-supplied content; storing and retrieving end-user conversation logs for analytics and safety; sending transactional notifications.

3. Categories of data subjects and personal data

  • Data subjects: Controller’s employees, customers, and website visitors.
  • Data categories: identifiers (email addresses if shared by the user), chat-message content, IP addresses, user agent, session identifiers, timestamps.
  • Sensitive data: not intentionally processed. Controller must not submit or permit submission of special-category data (health, biometric, political, etc.) without prior written agreement.

4. Processor obligations

  • Process personal data only on documented instructions from Controller (including these written terms and configuration in the dashboard).
  • Ensure persons authorized to process data are bound by confidentiality.
  • Implement appropriate technical and organizational measures (TLS, encryption at rest, access control, audit logging).
  • Assist Controller with data-subject requests, impact assessments, and breach notifications.
  • Notify Controller of a personal data breach without undue delay and within 72 hours of becoming aware.

5. Sub-processors

Controller authorizes the following sub-processors:

  • Hetzner Online GmbH (Germany) — infrastructure hosting.
  • Stripe, Inc. (USA) — billing only (Stripe is a separate Controller for payment-card data).
  • Anthropic PBC / OpenAI OpCo, LLC — only if Controller opts into BYOLLM; processes inbound chat messages for LLM inference.
  • SMTP relay provider — for transactional email.

Processor will notify Controller in advance of any material new sub-processor. Controller may object within 14 days; objection allows termination without penalty.

6. International transfers

Personal data is stored in the EU (Germany). Transfers to sub-processors outside the EU/EEA (such as US LLM providers when Controller enables BYOLLM) rely on the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) as incorporated by reference into each sub-processor’s agreement. Additional transfer safeguards (pseudonymization, encryption in transit) are applied.

7. Security measures

  • Transport encryption (TLS 1.2+), encryption at rest, signed session cookies.
  • Role-based access with separate admin and customer scopes.
  • Logging of administrative actions.
  • Prompt-injection detection, PII redaction, and output guardrails in the chat pipeline.
  • Rate limits per IP, session, and tenant.
  • Regular security patching and third-party dependency review.

8. Return and deletion of data

On termination, Controller may export conversation logs and indexed content as CSV within 14 days of written request. Personal data is deleted from production systems within 30 days of termination and from rotated backups within 90 days.

9. Audit rights

Processor will, on request (no more than once per 12 months), make available to Controller the information necessary to demonstrate compliance with this DPA, including a current security summary. On-site audits require 30 days’ notice and must not disrupt operations.

10. Liability

Liability under this DPA is subject to the same limitations set out in the Service Agreement.

Contact

Data protection queries: [email protected]